EUVD-2025-18101
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
Certain canvas operations could have lead to memory corruption. This vulnerability affects Firefox < 139.0.4.
Analysis
Critical memory corruption vulnerability in Firefox canvas operations that allows unauthenticated remote attackers to achieve arbitrary code execution with no user interaction required. Firefox versions prior to 139.0.4 are affected. The vulnerability has a near-perfect CVSS score of 9.8 due to network accessibility, low attack complexity, and complete compromise of confidentiality, integrity, and availability.
Technical Context
This vulnerability exists in Firefox's canvas rendering implementation, specifically within canvas operation handlers that perform memory operations without proper bounds checking. The root cause is CWE-787 (Out-of-bounds Write), a buffer overflow condition where canvas operations write data beyond allocated memory boundaries. Canvas is a core HTML5 feature used for 2D graphics rendering in web browsers. The memory corruption occurs during specific canvas operations that are accessible to any web content loaded in the browser. The vulnerability affects the Gecko rendering engine used by Firefox, impacting all Firefox versions below 139.0.4 across Windows, macOS, and Linux platforms.
Affected Products
Firefox (< 139.0.4)
Remediation
Immediate action required: Update Firefox to version 139.0.4 or later. Mozilla's official security advisory should be consulted at https://www.mozilla.org/en-US/security/advisories/ for detailed patch information and release notes. Users on Windows, macOS, and Linux should enable automatic updates or manually download the latest Firefox release immediately. Organizations managing Firefox deployments should prioritize this update in their patch management systems. No known workarounds exist for this memory corruption vulnerability; patching is the only secure remediation. Disable Firefox or restrict web browsing until the patch can be applied if delay is anticipated.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | not-affected | code not present |
| noble | not-affected | code not present |
| oracular | not-affected | code not present |
| plucky | not-affected | code not present |
| upstream | needs-triage | - |
| focal | DNE | - |
| questing | not-affected | code not present |
| Release | Status | Version |
|---|---|---|
| noble | not-affected | code not present |
| oracular | not-affected | code not present |
| plucky | not-affected | code not present |
| upstream | needs-triage | - |
| jammy | not-affected | code not present |
| focal | DNE | - |
| questing | not-affected | code not present |
| Release | Status | Version |
|---|---|---|
| bionic | needs-triage | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| bionic | ignored | - |
| focal | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| focal | ignored | - |
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| jammy | ignored | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| jammy | ignored | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| jammy | ignored | - |
| noble | ignored | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | DNE | - |
| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | ignored | - |
| oracular | ignored | - |
| plucky | ignored | - |
| upstream | needs-triage | - |
| questing | DNE | - |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | fixed | 148.0.2-1 | - |
| (unstable) | fixed | 139.0.4-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today